configuring-certificate-authority-with-openssl skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. Build a two-tier PKI Certificate Authority hierarchy (offline Root CA Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/configuring-certificate-authority-with-openssl/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-certificate-authority-with-openssl, or copy the skill folder into ~/.claude/skills/configuring-certificate-authority-with-openssl/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-certificate-authority-with-openssl/SKILL.md

SKILL.md (verbatim)

name: configuring-certificate-authority-with-openssl
description: Build a two-tier PKI Certificate Authority hierarchy (offline Root CA
  plus issuing Intermediate CA) using OpenSSL and the Python cryptography library,
  covering certificate extensions, CRL distribution points, OCSP responder
  configuration, and certificate policy management. Use when standing up an internal
  CA, issuing or revoking X.509 certificates, or designing PKI trust hierarchies for
  TLS, code-signing, or client-authentication use cases.
domain: cybersecurity
subdomain: cryptography
tags:
- cryptography
- pki
- certificate-authority
- openssl
- x509
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.DS-01
- PR.DS-02
- PR.DS-10
mitre_attack:
- T1649
- T1553.004
- T1557
- T1587.003

Configuring Certificate Authority with OpenSSL

Overview

A Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for issuing, signing, and revoking digital certificates. This skill covers building a two-tier CA hierarchy (Root CA + Intermediate CA) using OpenSSL and the Python cryptography library, including CRL distribution, OCSP responder configuration, and certificate policy management.

When to Use

  • When deploying or configuring configuring certificate authority with openssl capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Familiarity with cryptography concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Objectives

  • Create a Root CA with self-signed certificate
  • Create an Intermediate CA signed by the Root CA
  • Issue server and client certificates from the Intermediate CA
  • Configure Certificate Revocation Lists (CRLs)
  • Implement certificate policies and constraints
  • Build a complete PKI hierarchy programmatically

Key Concepts

CA Hierarchy

Root CA (offline, air-gapped)
  |
  +-- Intermediate CA (online, operational)
        |
        +-- Server Certificates
        +-- Client Certificates
        +-- Code Signing Certificates

Certificate Extensions

Extension Purpose Critical
basicConstraints CA:TRUE/FALSE, pathLenConstraint Yes
keyUsage keyCertSign, cRLSign, digitalSignature Yes
extendedKeyUsage serverAuth, clientAuth, codeSigning No
subjectKeyIdentifier Hash of public key No
authorityKeyIdentifier Issuer's key identifier No
crlDistributionPoints URL to CRL No
authorityInfoAccess OCSP responder URL No

Security Considerations

  • Root CA private key must be stored offline (air-gapped HSM)
  • Use minimum 4096-bit RSA or P-384 ECDSA for CA keys
  • Set path length constraints on intermediate CAs
  • Implement certificate policies (OIDs)
  • Enable CRL and OCSP for revocation checking
  • Audit all certificate issuance operations

Validation Criteria

  • Root CA self-signed certificate is valid
  • Intermediate CA certificate chains to Root CA
  • Issued certificates chain to Intermediate -> Root
  • Path length constraints are enforced
  • CRL is generated and accessible
  • Revoked certificates appear in CRL
  • Certificate policies are correctly embedded

Other files in this skill

assets/template.md (verbatim)

Certificate Authority Configuration Template

CA Directory Structure

pki/
  root-ca/
    private/root-ca.key
    certs/root-ca.crt
    serial.json
    index.json
  intermediate-ca/
    private/intermediate-ca.key
    certs/intermediate-ca.crt
    certs/ca-chain.crt
    certs/issued/
    crl/intermediate.crl
    serial.json
    index.json

OpenSSL Configuration Template (openssl.cnf)

[ca]
default_ca = CA_default

[CA_default]
dir               = ./ca
certs             = $dir/certs
new_certs_dir     = $dir/newcerts
database          = $dir/index.txt
serial            = $dir/serial
private_key       = $dir/private/ca.key
certificate       = $dir/certs/ca.crt
default_md        = sha256
default_days      = 365
policy            = policy_strict

[policy_strict]
countryName       = match
organizationName  = match
commonName        = supplied

[v3_ca]
basicConstraints = critical, CA:true
keyUsage = critical, keyCertSign, cRLSign
subjectKeyIdentifier = hash

[v3_intermediate_ca]
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, keyCertSign, cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always

[server_cert]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always

Certificate Issuance Checklist

  • Verify CSR subject and SAN entries
  • Validate key strength (minimum 2048-bit RSA or P-256 ECDSA)
  • Check domain ownership or authorization
  • Set appropriate validity period
  • Include correct extensions (EKU, constraints)
  • Sign with intermediate CA (never root)
  • Record in certificate database
  • Provide full chain to requester

references/api-reference.md (verbatim)

Certificate Authority with OpenSSL — API Reference

Libraries

Library Install Purpose
cryptography pip install cryptography X.509 certificate generation, parsing, and validation
pyOpenSSL pip install pyOpenSSL OpenSSL wrapper for certificate operations

Key cryptography Methods

Method Description
x509.CertificateBuilder() Build X.509 certificates
rsa.generate_private_key(65537, key_size) Generate RSA private key
x509.load_pem_x509_certificate(data) Parse PEM certificate
cert.subject.rfc4514_string() Get subject as RFC 4514 string
x509.random_serial_number() Generate unique serial number

OpenSSL CLI Commands

Command Purpose
openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 Create self-signed CA
openssl req -new -key server.key -out server.csr Generate CSR
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key Sign certificate
openssl verify -CAfile ca.crt server.crt Verify certificate chain
openssl x509 -in cert.pem -text -noout Display certificate details

Certificate Best Practices

Parameter Recommended Value
Root CA Key Size RSA 4096 or EC P-384
Server Key Size RSA 2048+ or EC P-256
Signature Algorithm SHA-256 or SHA-384
Root CA Validity 10-20 years
Server Cert Validity 1 year (398 days max for public)

External References

references/standards.md (verbatim)

Standards and References - Certificate Authority with OpenSSL

Primary Standards

RFC 5280 - Internet X.509 PKI Certificate and CRL Profile

RFC 6960 - X.509 OCSP

RFC 3647 - Internet X.509 PKI Certificate Policy and Certification Practices Framework

NIST SP 800-57 Part 1 Rev. 5

CA/Browser Forum Baseline Requirements

Tools

OpenSSL

Python cryptography library

references/workflows.md (verbatim)

Workflows - Certificate Authority with OpenSSL

Workflow 1: Build Two-Tier CA Hierarchy

[Generate Root CA Key] (RSA 4096 / ECDSA P-384)
      |
[Create Root CA Self-Signed Certificate]
(validity: 20 years, basicConstraints: CA:TRUE)
      |
[Store Root CA Key Offline]
      |
[Generate Intermediate CA Key]
      |
[Create Intermediate CA CSR]
      |
[Sign Intermediate CSR with Root CA]
(pathLenConstraint: 0, keyUsage: keyCertSign, cRLSign)
      |
[Create CA Chain Bundle]
(intermediate.crt + root.crt)

Workflow 2: Issue End-Entity Certificate

[Applicant Generates Key + CSR]
      |
[Submit CSR to Intermediate CA]
      |
[Validate CSR]
(check subject, SAN, key strength)
      |
[Sign with Intermediate CA Key]
(basicConstraints: CA:FALSE)
(extendedKeyUsage: serverAuth / clientAuth)
      |
[Issue Certificate]
      |
[Record in Certificate Database]

Workflow 3: Certificate Revocation

[Revocation Request]
      |
[Verify Authorization]
      |
[Revoke Certificate]
(record serial number + reason + date)
      |
[Generate Updated CRL]
(sign with CA key, set nextUpdate)
      |
[Publish CRL to Distribution Point]
      |
[Update OCSP Responder Database]

Workflow 4: OpenSSL CA Commands

# 1. Create CA directory structure
mkdir -p ca/{certs,crl,newcerts,private}
touch ca/index.txt
echo 1000 > ca/serial
echo 1000 > ca/crlnumber

# 2. Generate Root CA
openssl genrsa -aes256 -out ca/private/ca.key 4096
openssl req -config ca/openssl.cnf -key ca/private/ca.key \
    -new -x509 -days 7300 -sha256 -extensions v3_ca -out ca/certs/ca.crt

# 3. Generate Intermediate CA
openssl genrsa -aes256 -out intermediate/private/intermediate.key 4096
openssl req -config intermediate/openssl.cnf \
    -key intermediate/private/intermediate.key -new -sha256 -out intermediate/csr/intermediate.csr
openssl ca -config ca/openssl.cnf -extensions v3_intermediate_ca \
    -days 3650 -notext -md sha256 -in intermediate/csr/intermediate.csr \
    -out intermediate/certs/intermediate.crt

# 4. Issue server certificate
openssl req -config intermediate/openssl.cnf \
    -key server.key -new -sha256 -out server.csr
openssl ca -config intermediate/openssl.cnf -extensions server_cert \
    -days 365 -notext -md sha256 -in server.csr -out server.crt

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.